Windows | Certificate Rotation 2027

The certificates used by Windows devices to establish a trusted connection to Windows Update will expire on May 17, 2027, and June 19, 2027. Without the replacement certificates, a device will lose access to Windows Update after the respective date and will no longer receive updates.

Microsoft continues to deliver replacement certificates silently through the monthly security updates. Therefore, a currently patched and supported device requires no further action.

The catch lies with the stragglers. Devices with outdated patch levels or running an unsupported version slip through the cracks. The timing of the issue depends on the Windows version, which is why it's worth staggering the minimum requirements:

A quick query on the individual device shows you the version and the most recently installed updates. This is sufficient to quickly classify a suspicious client.

The OsHardwareAbstractionLayer property returns the full build number including the revision, i.e., exactly the version you compare against the required minimum update.

You don’t need to check the patch level device by device across the fleet. If you’re in Intune, you can see via Windows Update for Business Reports which devices still don’t have the required minimum update. Using Graph PowerShell, you can pull the devices with their version and last sync to isolate the stragglers.

For a straggler that missed the update, you retrieve the appropriate security update from the Microsoft Update Catalog and deploy it using your usual management tools. Devices on an unsupported version should be upgraded to a supported version first—otherwise, even the certificate won’t help.

The topic may be unspectacular, but it affects every fleet. Those who patch their clients and servers monthly anyway are on the safe side. The real work lies in tracking down the devices that haven't had a complete patch status for months.